Home > Vulnerability Database > CVE-2020-26136

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2020-26136

Good to know:

Date: June 8, 2021

In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.

Language: PHP

Severity Score

6.5

Related Resources (8)

Url: https://forum.silverstripe.org/c/releases

Url: https://www.silverstripe.org/blog/tag/release

Url: https://www.silverstripe.org/download/security-releases

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2020-26136.yaml

Url: https://www.silverstripe.org/download/security-releases/cve-2020-26136

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-26136

Url: https://www.silverstripe.org/download/security-releases/

Url: https://www.mend.io/vulnerability-database/CVE-2020-26136

Severity Score

6.5

Weakness Type (CWE)

Authentication Issues

CWE-287

Authentication Bypass Using an Alternate Path or Channel

CWE-288

Top Fix

Upgrade Version

Upgrade to version 3.5.0,4.0.0-alpha2

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	HIGH
Availability (A):	NONE

CVSS v2

Base Score:	4.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	SINGLE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us